Black Duck step configuration

Scan code repositories and container images with Black Duck.

You can scan your repositories and container images using Black Duck Hub and ingest the results into Harness STO.

Important notes for running Black Duck Hub scans in STO

• Container image scans: Black Duck container scans require a Docker-in-Docker background step when you run them on Kubernetes or Docker build infrastructures.

  • DinD image: Set the Background step image to docker:24-dind. Black Duck Detect Docker Inspector aligns its parser with Docker versions 20.0.x through 24.0.x. Go to Supported image formats in the Black Duck Detect documentation to review image format requirements and Docker version compatibility.

  • Tar file scans: If you scan a local OCI or Docker archive (.tar), create the archive with Docker 24.0.x or another version in the 20.0.x through 24.0.x range.

• You can utilize custom STO scan images and pipelines to run scans as a non-root user. Go to Configure your pipeline to use STO images from private registry for setup instructions.

• STO supports three different approaches for loading self-signed certificates. For more information, refer Run STO scans with custom SSL certificates.

Black Duck Hub step settings for STO scans

The recommended workflow is to add a BlackDuck step to a Security or Build stage and then configure it as described below.

Scan

Scan Mode

Scan Configuration

Target

Type

Target and Variant Detection

Name

Variant

Workspace

Container image

Type

The registry type where the image is stored:

• Docker v2 A registry that uses the Docker Registry v2 API such as Docker Hub, Google Container Registry, or Google Artifact Registry.

• AWS ECR

• Jfrog Artifactory

• Local Image in this Stage Scan a local image built and stored within the context of the current stage (via /var/run/docker.sock registered as a stage level volume mount).

• Local OCI/Docker archive in this Stage Scan an OCI or Docker archive that has been created and stored within the current stage. The path to the archive can be specified via the workspace field, and ensure that the path to which the archive is saved is a shared volume mount.

Domain (extraction)

Name

Tag/Digest

Ingestion

Ingestion File

Authentication

Domain

Enforce SSL

API Version

Type

Access Token

Scan Tool

Project Name

Project Version

Log Level

Additional CLI flags

Use this field to run the synopsys detect scanner with flags such as:

-detect.tools.excluded {DETECTOR, SIGNATURE}

This string excludes some detectors from a scan.

Fail on Severity

Settings

Additional Configuration

Advanced settings

Proxy settings

Troubleshooting Black Duck Hub

Scan fails with message "Could not connect to addon client after max retries"

This message indicates that indicates that the container running the BlackDuck scan step is terminated abruptly due to insufficient resources. Harness recommends that you increase the resource allocation using an iterative approach: Run the scan again with memory: 1Gi and cpu: "1.0", monitor the results, and adjust the resource allocation until the scanner runs successfully.

For more information, go to Optimize STO pipelines.